» yet_another_cleaner_glp.exe
Overview
Analysis
File Details
Downloads (65)

yet_another_cleaner_glp.exe

YAC Security Protection

Elex do Brasil Participações Ltda

The application yet_another_cleaner_glp.exe by Elex do Brasil Participaçõesa has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from dl_150.yac.mx and multiple other hosts.

File name:

Publisher:

Elex do Brasil Participações Ltda (signed and verified)

Product:

YAC Security Protection

Description:

Setup

Version:

4.4.34.11670

MD5:

c50109e904e58d3023d280ea19996c41

SHA-1:

296ae1f5417fe71bf0c7897356213261e0b20d1f

SHA-256:

c42f68e935c92c0ed468467af53b6fa3c4e6d5631e2615b7133794b8bde94947

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/14/2024 6:13:37 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Optional.Installer.X

14.6.7.10

File size:

705.2 KB (722,104 bytes)

Product version:

4.4.34.11670

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\yet_another_cleaner_glp.exe

Digital Signature

Signed by:

Elex do Brasil Participações Ltda

Authority:

GlobalSign nv-sa

Valid from:

9/24/2013 4:46:21 AM

Valid to:

8/17/2014 7:28:53 AM

Subject:

CN=Elex do Brasil Participações Ltda, O=Elex do Brasil Participações Ltda, L=Consolação, S=São Paulo, C=BR

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

11215F51916F2BB9F54E82871FEA88CE8F5E

File PE Metadata

Compilation timestamp:

6/6/2014 12:54:41 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

12288:C71503p/FAm6UbA9cdYRQFkW3eUmMRYWliQcW:CZmp/FAm6Uk9MYqF/OFeXd

Entry address:

0xC2D2

Entry point:

E8, 3F, 3A, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, BC, F6, 41, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 38, E2, 41, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, BC, F6, 41, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00, 0F, 85, B8, 01, 00, 00, F7, C6... 
[+]

Code size:

88 KB (90,112 bytes)

The file yet_another_cleaner_glp.exe has been seen being distributed by the following 50 URLs.

http://dl_150.yac.mx/download/.../yet_another_cleaner_mar.exe

http://www.yac.mx/download/.../down.php?pt=afd

http://www.yac.mx/download/.../down.php?pt=ses

http://www.yac.mx/download/.../down.php?pt=vel

https://secure-lax.adnxs.com/click?OOcmt5g5pT9Op7CQisSgP4ts5_up8bI_TqewkIrEoD855ya3mDmlP8Fv957mSn4rfCBuXhU-FntBfJhTAAAAAB4KJwBSBQAAdgIAAAIAAACYPOoAphkGAAAAAQBVU0QAVVNEACwB-gDpqwAAX5EAAQUAAQIAAI4A3CfOIAAAAAA./cnd=!fQY0PwjsmvQBEJj5qAcYprMYIAA./referrer=https://login.live.com/login.srf/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=lax1CPzAuPPVwo-LexACGMHf3ffp3JK_KyIOMTg5LjEzMi4xMzAuOTIoATDB-OGcBQ..&lplink=http://www.yac.mx/download/config/down.php?pt=broe

http://nym1.ib.adnxs.com/click?exSuR-F6hD9YObTIdr5_PwAAAAAAAPA_WDm0yHa-fz97FK5H4XqEP_kBnkStcwwhUdKXGK7MgGIId5hTAAAAAJSILQAnCgAAdgIAAAIAAAAXk-8AJLsGAAAAAQBVU0QAVVNEACwB-gCMxAAAx7AAAQUAAQIAAJAABSTdKgAAAAA./cnd=!YAbmOwi3rfQBEJemvgcYpPYaIAA./referrer=http://www.youtube.com/clickenc=http://nym1.ib.adnxs.com/click?LvE8amKpWz_jtK3PCb9UP3npJjEIrOg_47Stzwm_VD8u8TxqYqlbP7dfECKrEEMgUdKXGK7MgGIId5hTAAAAAExvLQAyAwAAKAoAAAIAAACkLPcAdkIFAAAAAQBVU0QAVVNEACwB-gD6wAAAMbIAAQUAAQIAAJAATiUMAwAAAAA./cnd=!rgYgQAjUnP0BEKTZ3AcY9oQVIAA./.../clickenc=http://nym1.ib.adnxs.com/click?exSuR-F6dD-cxCCwcmhxP7pJDAIrh6Y_nMQgsHJocT97FK5H4Xp0P9IQCEGuL-lLUdKXGK7MgGIHd5hTAAAAAHnVJQDaBgAAMgMAAAIAAADzX-MAHfAFAAAAAQBVU0QAVVNEACwB-gBzRQAAjbYAAgUAAQIAAI4AeCVgxAAAAAA./cnd=%21XwYsPAiJw-cBEPO_jQcYneAXIAA./referrer=http%3A%2F%2Fwww.youtube.com/clickenc=http%3A%2F%2Fclickus.tractionize.com%2Fst%3Fcipid%3D166030%26ttype%3D1%26crid%3D1337588%26dast%

http://dl_149.yac.mx/download/.../yet_another_cleaner_mma.exe

http://lax1.ib.adnxs.com/click?A4pQgVp8ej-PBDgkxoZ0P7gehetRuJ4_jwQ4JMaGdD8CilCBWnx6P3K2HQyaZ3Y-pUMAIxgrGQLh9pVTAAAAAGVIIQByBwAAdgIAAAIAAAAXk-8As2AFAAAAAQBVU0QAVVNEACwB-gAVDgAARrsAAgUAAQIAAJAAQCBPRgAAAAA./cnd=!NQZOOwi3rfQBEJemvgcYs8EVIAA./referrer=http://site.ebrary.com/lib/initesp/docDetail.action?docID=10317299/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mman&subid=lax1CKWHgZiC48qMAhACGPLs9uCg85m7PiIPMTg5LjE3Mi4xMTIuMTM5KAEw4e3XnAU.&lplink=http://www.yac.mx/download/config/down.php?pt=mman

http://www.yac.mx/download/.../down.php?pt=xtva

http://ams1.ib.adnxs.com/click?drIfMXyegj-SMzfnC2t9P2Q730-Nl84_kjM35wtrfT92sh8xfJ6CP743bE1URxFGuXgPpCgXU3LVEZZTAAAAAHxZKQBSBQAAdgIAAAIAAADyBegAVyUGAAAAAQBVU0QAVVNEACwB-gDgPgAAcskAAQUAAQIAAJAASCJd0QAAAAA./cnd=!RQYOOgiHm_QBEPKLoAcY18oYIAA./referrer=www.playxn.com/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=ams1CLnxvaCK5cWpchACGL7vsOvE6tGIRiIMOTIuODQuODIuMTEzKAEw1aPYnAU.&lplink=http://www.yac.mx/download/config/down.php?pt=broe

http://www.yac.mx/download/.../down.php?pt=mmab

https://secure-lax.adnxs.com/click?0uNy_p09gj8U7RvA_tF8P8uhRbbz_bQ_FO0bwP7RfD_S43L-nT2CP6_CrL9xhrV315xVebLey2HVXJZTAAAAAB4KJwBSBQAAdgIAAAIAAACYPOoAphkGAAAAAQBVU0QAVVNEACwB-gDpqwAAsL4AAQUAAQIAAI4A6S3sGAAAAAA./cnd=!bgZDPgjUnPsBEJj5qAcYprMYIAA./referrer=https://twitter.com//clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=lax1CNe51sqn1vflYRACGK-Fs_2bzuHadyIPMjAxLjE0MS4xMjcuMjI4KAEw1bnZnAU.&lplink=http://www.yac.mx/download/config/down.php?pt=broe

http://nym1.ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAGIQWDm0yOo_AAAAAAAAAAAAAAAAAAAAAK_aAePUKLs6jYq_eZg-HWda0JRTAAAAAM4SKgDLBgAAdgIAAAIAAACAOOoAeokFAAAAAQBVU0QAVVNEANQBPADhtAAA4M8AAgUAAQIAAJAAiBmRVwAAAAA./cnd=!jQb5PgjqmvQBEIDxqAcY-pIWIAE./referrer=http://santafecapital.olx.com.ar/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=nym1CI2V_s2H08-OZxACGK-1h5jOmsrdOiIOMTkwLjEwMy44Ni4xMzEoATDaoNOcBQ..&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://nym1.ib.adnxs.com/click?uEW6fH1StT-WUx7sf_OwP4PAyqFFtts_llMe7H_zsD-4Rbp8fVK1P4YyWSBQRvgakClfR4_ftGNf25NTAAAAAL19KAB6AgAAdgIAAAIAAACYPOoAdy0FAAAAAQBVU0QAVVNEACwB-gCZzgAApqUAAQUAAQIAAIoAOSncVQAAAAA./cnd=!6wbxQAjlmvQBEJj5qAcY99oUIAE./referrer=http://d1m28cwm9ho97l.cloudfront.net/third-party/creative2885.html?ss_pub_url=http://www.tv-envivo.com.ar/2011/01/tyc-sports-en-vivo.html&cm=http://cts.servesharp.net/click?c=957;a=2885;d=177387;k=/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=nym1CJDT_Lr08bfaYxACGIbl5IKCypH8GiIOMTg2LjEzNy4yMzIuNjcoATDfts-cBQ..&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://www.yac.mx/download/.../down.php?pt=a4g

http://nym1.ib.adnxs.com/click?ZB485sFjrj9aZDvfT42nP1pkO99Pjac_JX5cNe0Hqz-M9mQBeHCxP0S6qyP0l18R-EOylZYVvFu_w5hTAAAAAP92FQByBwAAdgIAAAIAAAAok-8A8M4FAAAAAQBVU0QAVVNEANgCWgDVowAAMuIAAgUAAQIAAIYARiiDiQAAAAA./cnd=!YQafPAi3rfQBEKimvgcY8J0XIAA./referrer=http://img.df-stream.net/df/iframe_4.1.html/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mman&subid=nym1CPiHya3psoXeWxACGMT0rp3C_uWvESINMTg2LjYuMTEwLjE1MigBML-H45wF&lplink=http://www.yac.mx/download/.../down.php?pt=mman

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=nIgNaZYl8DuntpSRw7EwbKOrWOYGpuHGmn5X4UUgQykhXZGEnCxj8bS02IkqII771u_H5FRCghBXCOm405gG87Cdh4K27dd7zqUgcP2W930EGKbCFe4BKvRcsIadKybdYzcc6Ca_UIjlbSCF5PS1-Lcs1R0CRAYt5z0-g-xjD2iDYGdEeYBDebyjqRsVJtCTPocAMFzD93Pu4_S6drKKXNWmPgivW_ITPm2JINPhreRzEFxEKar2IYXeWEsEStJHL37S3sYswliKRszq5c1o3QQ4bzlYPM4SQreQwdyzhOPdaQ9IM-YFdADwwOY332kh1ZV2AxWcB6WPKS5ZQk1cRGCys-FKIanra95ojnVlwZ7KJhUn2kqEXzdw8KZhWDyAiJ7VJLHOKA&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://nym1.ib.adnxs.com/click?AcEX28JMwj8BwRfbwkzCPxsv3SQGge0_AcEX28JMwj8BwRfbwkzCPw4xY7OS8yMc8GOityMwYWI9vJlTAAAAADKHLQB2AgAAdgIAAAIAAACYPOoA-7oGAAAAAQBVU0QAVVNEACwB-gBpxAAAeakAAgQAAQIAAJAABCZV7AAAAAA./cnd=!HAcNQgjumvQBEJj5qAcY-_UaIAQ./referrer=http://landing.entertainment-factory.com/promo_w96442.html?af_e=149952/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=nym1CPDHib27hMywYhACGI7ijJur8vyRHCINMTg2LjQ5LjgzLjIxMCgBML345pwF&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://fra1.ib.adnxs.com/click?nYvrKP33dj8DrTczl2hzP_YoXI_C9dg_A603M5docz-di-so_fd2P0ZVU5BE-lV6V3StT-2bsH5eJpNTAAAAAFiEJgDIAQAAdgIAAAIAAADyBegArJoGAAAAAQBVU0QAVVNEACwB-gCj_wAAiswAAQUAAQIAAI4ApyntMAAAAAA./cnd=!BwbpOAiHm_QBEPKLoAcYrLUaIAA./referrer=http://www.bixi.ro/2337-trenul_cu_fructe.html/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=fra1CNfotf3U_abYfhACGMaqzYLJyP6qeiIOMjEzLjIzMy45MC4xMDAoATDezMycBQ..&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://nym1.ib.adnxs.com/click?GuaAipJxkj8Oy0fwb5aMPxkEVg4tsq0_DstH8G-WjD8Z5oCKknGSP2Z5jXRHjMxSI-AoAyHk6Hc_YZRTAAAAAKwjJQCZBwAAdgIAAAIAAACpPOoAzEYEAAAAAQBVU0QAVVNEANgCWgARTQAAAa8AAQUAAQIAAI4AVyRwvgAAAAA./cnd=!hwbvPwjsmvQBEKn5qAcYzI0RIAA./referrer=http://en.eazel.com//clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=broe&subid=nym1CKPAo5mQhLn0dxACGObytaT3iKPmUiIMMjAwLjEyMy4zOC40KAEwv8LRnAU.&lplink=http://www.yac.mx/download/.../down.php?pt=broe

http://lax1.ib.adnxs.com/click?exSuR-F6hD9MN4lBYOWAPwAAAAAAAPA_TDeJQWDlgD97FK5H4XqEP_QDer76XilPZ3GF1PK8nhqOJZZTAAAAAAD7LAC2BwAAdgIAAAIAAAATk-8ALqkFAAAAAQBVU0QAVVNEAKAAWAJ5pQAAiLsAAgUAAQIAAIwA4SOHEgAAAAA./cnd=!PgZUOwi3rfQBEJOmvgcYrtIWIAA./referrer=http://ib.adnxs.com/tt?id=2474233&_=1402348941675/clickenc=http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mman&subid=lax1COfilaStnq_PGhACGPSH6POr39eUTyIMMjAxLjE1My4xNy43KAEwjsvYnAU.&lplink=http://www.yac.mx/download/.../down.php?pt=mman

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=E1z7Cs0Zhu_CcHr6FoLPJhWkts76M52GNSnDq373bPEn7OmfJJjRm4AAq9owWe5DbAM31lyYzeSlyW2uHZSMw4Z2KZXsIV38X9B_KAFRlFSqegoUOUlKe1uquqDWrhUrkfIuOzMBKsb9DS7eASYytXZkRfZ098ytBxfOwd_XgcX8_6fvVsZ_3E_CbrsSWMLWIhzT5glRf9dmMDb6mvCpKN8WrJfSczLlnQe2slOcxMrj0_SfhBYGjqKjcuxMNzMvYF8gZFThbLCk_reRLk5H4AYCsuPhBZ6ImKlVI5XYH8kCZQ9a8NTSBiMvKGsaUDzrqeQ5xqp26LjVA7elBEmkoXC9vnVDlz9YOAaQ3h1hnBIaHygKoy8PpUvQQCHtvm7G5qz2ldPhkw&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://www.yac.mx/download/.../down.php?pt=dne

http://www.yac.mx/download/.../down.php?pt=mcr

http://dl_151.yac.mx/download/.../yet_another_cleaner_xtva.exe

http://www.yac.mx/download/.../down.php?pt=brob

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=Np9ut1N5fxVajXW0YKRMNyCz2xvkmiMTys132QIFl_ou--fHwW3Llk2lk3QV_Tt4sok65U5EY3JFogaimxMqq44TL0LfgV4SHYvpGMeGCcw9mqKrQpc3JHA4nwblWeAAlTi2m3SBMs_q0FCGaaNl4u73Mp1OBTCcPrLIXEH1Zrul_cSTzB8othU6fdq4p0mv-NCIfe1mXyQVFGrov__AcnZuQ1zuTKppOlUMrcy3qUQey--RRSSdpSiz4_jUnHx62rLYB_yEBGEB9C84U88D2tzuYjIUaHhs-Z812IFe47OBnjEazO2UppUOhqavovOz3bE-IHjZnEjRnVLkGz6cVQOVK706iwxK_LQloheY4lCvIs0BToUfbhUdkdI6xzvLLMxR8hHebgLj4HSLTCAxLHNc69UY2s_pXWxFRM-SgvHiVCenZ0rNRj4fT_kw1t8xllHx5YLTnQ8&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://adm.soft365.com/ads/adsavess?sid=yac&ptid=mmacn&subid=FvDpv25MMV29STCsCKhC54v4KHI5qq3zBOrd4m1CB-DgoGiYB3Ni3Tz0WyXriE07_7_szX2rMvWSAGXDRuKcTUlq3xsskwv6gMh_RgMRmnGsxDII8qymr0CTRXosq1kKP53aHnzZA4HeSn9rA0k55XRKLkKNpULv4qFovCgxZi6IZpLXnAP6CWRKjI4WidWef-GdcT45gSM795fCNpDRyvjLBFeoaqg25EmxVRJdlgN4FVMOFJ5Yl-k0lcjsXm6u0HgQ2eWI57bWnl2upqIs7flooj8uDMOEWRxDJ4wM7gk2PPUEO2EuSiSi5sW_qot-slUgKDUp4rIKTvxm4xbT0_dbUHOINPibnOmm14UE1FdKiivZxjusb_h4NyNM-bU0iq5JyQoX-A&lplink=http://www.yac.mx/download/.../down.php?pt=mmacn

http://www.yac.mx/download/.../down.php?pt=mmac

http://www.yac.mx/download/.../down.php?pt=brod

Latest 30 of 65 download URLs

Remove yet_another_cleaner_glp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.